Web.config 差分テンプレ

Web.config

<configuration>
  <system.web>
    <httpRuntime enableVersionHeader="false" />
    <httpCookies httpOnlyCookies="true" />
  </system.web>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
        <!--
          セキュリティ対策用カスタム HTTP ヘッダ
          https://www.ipa.go.jp/security/awareness/vendor/programmingv2/contents/705.html
          http://d.hatena.ne.jp/hasegawayosuke/20110107/p1
        -->
        <add name="X-Content-Type-Options" value="nosniff" />
        <add name="X-XSS-Protection" value="1; mode=block" />
        <add name="X-Frame-Options" value="DENY" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

Web.Release.config

<configuration>
  <system.web>
    <compilation xdt:Transform="RemoveAttributes(debug)" />
    <httpCookies httpOnlyCookies="true" requireSSL="true" lockItem="true" xdt:Transform="Replace" />
  </system.web>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Strict-Transport-Security" value="max-age=31536000" xdt:Transform="Insert" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>